CVE-2026-14457 OpenSSL CVE debrief

Who should care

Defenders responsible for OpenSSL configurations, TLS deployments, and systems using RPKs should assess exposure and prioritize upgrades to patched versions. This includes administrators of servers and clients using OpenSSL for secure communication.

Why it matters

CVE-2026-14457 is a NULL pointer dereference vulnerability in OpenSSL that can lead to a Denial of Service (DoS). It affects configurations using RFC7250 Raw Public Keys (RPKs) without a corresponding certificate. Defenders should prioritize upgrading to patched versions and review RPK configurations to prevent potential DoS attacks.

• Potential Denial of Service (DoS) due to application abort
• Verification of RPK configurations and corresponding certificates required
• Upgrade to patched OpenSSL versions necessary for secure operation
• Review of system and application configurations to ensure proper certificate usage

Technical summary

The vulnerability exists in OpenSSL when using RFC7250 Raw Public Keys (RPKs) without a corresponding certificate. A NULL pointer dereference occurs when a remote peer solicits raw public keys and sends the 'signature_algorithms_cert' TLS extension, potentially leading to a Denial of Service (DoS) due to an application abort. This issue affects OpenSSL configurations with RPKs enabled and no associated certificate, impacting systems using RPKs without a certificate. Defenders should prioritize upgrading to patched versions and review RPK configurations to prevent potential DoS attacks.

Defensive priority

Defenders should prioritize upgrading to patched versions of OpenSSL, specifically 3.4.8, 3.5.9, 3.6.5, or 4.0.3, to prevent potential DoS attacks. Systems using RPKs without a certificate are at higher risk and should be updated immediately.

Recommended defensive actions

• Upgrade to OpenSSL version 3.4.8, 3.5.9, 3.6.5, or 4.0.3 or later
• Configure RPKs with a corresponding certificate
• Review and update affected systems and applications
• Monitor for potential DoS attacks
• Perform vulnerability scanning to identify exposed systems
• Implement additional monitoring for suspicious activity
• Review system and application configurations to ensure proper certificate usage

Evidence notes

The vulnerability is caused by a NULL pointer dereference when a remote peer solicits raw public keys and sends the 'signature_algorithms_cert' TLS extension. The issue is limited to configurations with RPKs enabled and no associated certificate. The impact is restricted to a possible Denial of Service due to an application abort.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.